Q99
Single choice
Customer records may have been exposed, triggering a possible notification obligation. Who should decide the external-notification action?